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CLAIMS 

What is claimed is: 

1 . A method for decision analysis and resolution, wherein an event is 
associated with a root cause, the method comprising the steps of: 

relating a solution to the root cause; 

determining whether the solution can resolve the event automatically; 
automatically resolving the event when the event can be resolved automatically; 

and 

providing information for resolving the event to a user when the event caimot be 
resolved automatically. 

2. The method of claim 1, wherein the step of relating a solution to a root 
cause includes utilizing a solutions catalog. 

3. The method of claim 1, wherein the step of relating a solution to a root 
cause includes chaining a series of solution objects to the root cause. 

4. The method of claim 1, wherein the step of relating a solution to a root 
cause includes interoperating with a trouble ticket system. 

5. The method of claim 1 , wherein the events are related to object oriented 
constructs, wherein the object oriented constructs include underlying intelligence, 
wherein the intelligence includes relationships between the underlying object oriented 
constructs, wherein the step of determining whether the solution can resolve the event 
automatically utilizes the intelligence and the relationships to evaluate the validity of the 
solution. 

6. The method of claim 5, wherein the validity of the solution is based upon 
previous success in resolving the event and descriptions of the related root cause. 
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7. The method of claim 5, wherein the validity of the solution is based upon 

previous success in resolving the event and descriptions of the related root cause. 

8. The method of claim 1 , wherein the step of determining whether the 
solution can resolve the event automatically includes determining whether a root cause 
has a statistically significant correlation with a defined set of tasks leading to a resolution 
of the event. 

9. The method of claim 1 , wherein the step of determining whether the 
solution can resolve the event automatically includes using object-oriented constructs. 

1 0. The method of claim 1 , wherein the step of determining whether the 
solution can resolve the event automatically includes allowing a user to prevent 
automated resolution. 

1 1 . The method of claim 1, wherein the step of automatically resolving the 
event includes providing information to a user by updating a trouble ticket. 

12. The method of claim 1, wherein the step of providing information for 
resolving the event to a user includes presenting the user with suggested corrective 
actions. 

13. The method of claim 1, wherein the step of providing information for 
resolving the event to a user includes evaluating the strength of relationships between a 
root cause construct and a resolution construct. 

14. The method of claim 1, wherein the step of providing information for 
resolving the event to a user includes utilizing an object oriented model to define object 
constructs, wherein the constructs are then presented to the user. 
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15. The method of claim 1, wherein the step of providing information for 

resolving the event to a user includes a visualization of the information for resolving the 
event. 

1 6. The method of claim 1 , wherein the step of providing information for 
resolving the event to a user includes a visualization of the information for resolving the 
event, wherein the visualization includes providing an overlay, wherein the overlay offers 
information about the event. 

17. The method of claim 1, wherein the step of providing information for 
resolving the event to a user includes providing a searchable knowledge base. 

18. The method of claim 1, wherein the step of providing information for 
resolving the event to a user includes presenting a probability, wherein the probability is 
indicative of the success of the solution. 

1 9. The method of claim 1 , wherein the method is practiced in a network, 
further including the step of revising the network based on data generated while resolving 
the event. 

20. The method of claim 1 9, wherein the step of revising the network includes 
revising a datastore within the network based on the event resolution. 

2 1 . The method of claim 1 , wherein the method is practiced in a network, 
further including the step of distributing solutions in the network. 

22. The method of claim 1, wherein the method is practiced in a network, 
further including the step of creating heuristics related to the solution, wherein the 
heuristics are configured to be available within the network to evaluate proposed 
solutions. 
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23. The method of claim 1, wherein the event is associated with a security 

fauh. 

24. The method of claim 1 , wherein the event is associated with a network 
operational fault. 

25. A network system configured to resolve network problem events 
correlated to root causes in an object-oriented environment, including: 

a resolution module configured to generate a proposed response to the detected 
event; and 

a solution module configured to resolve the detected event using the proposed 
response, 

wherein the resolution module is configured to cooperate with the solution 
module to automatically implement the proposed response, 

wherein the resolution module is configured to cooperate with the solution 
module to present the proposed response as a suggested response to resolve the detected 
event. 

26. The system of claim 25, further including a user input module configured 
to allow a network user to initiate implementation of the proposed response. 

27. The system of claim 25, wherein the resolution module further includes a 
heuristics module configured to track proposed responses to detected events. 

28. The system of claim 27, wherein the heuristics module is configured to 

correlate proposed responses to successful and unsuccessful resolutions of detected 
events. 

29. The system of claim 28, wherein the heuristics module is configured to 
solicit new responses to detected events based upon previous successful resolutions of 
similar detected events. 
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30. The system of claim 28, wherein the heuristics module is configured to 
present suggested responses to detected events based upon previous successful 
resolutions of similar detected events. 

3 1 . The system of claim 27, wherein the heuristics module is configured to 
generate automated responses to detected events based upon previous successful 
resolutions of similar previously selected responses. 

32. The system of claim 31, wherein the heuristics module is configured to 
generate the automated responses based upon a predetermined success threshold for 
previously detected events. 

33. The system of claim 32, wherein the heuristics module is configured to 
generate automated responses based upon previous optional responses once a success 
threshold for the previous optional responses has been reached. 

34. A computer readable medium for decision analysis and resolution, 
wherein an event is associated with a root cause, the computer readable medium 
comprising: 

logic for relating a solution to the event based on the root cause; 
logic for determining whether the solution can resolve the event automatically; 
logic for automatically resolving the event when the event can be resolved 
automatically; and 

logic for providing information for resolving the event to a user when the event 
cannot be resolved automatically. 

35. The computer readable medium of claim 34, wherein the logic for relating 
a solution to a root cause includes utilizing a solutions catalog. 
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36. The computer readable medium of claim 34, wherein the logic for relating 
a solution to a root cause includes chaining a series of solution objects to the root cause. 

37. The computer readable medium of claim 34, wherein the logic for relating 
a solution to a root cause includes interoperating with a trouble ticket system. 

38. The computer readable medium of claim 34, wherein the events are related 
to object oriented constructs, wherein the object oriented constructs include underlying 
intelligence, wherein the intelligence includes relationships between the underlying 
object oriented constructs, wherein the logic for determining whether the solution can 
resolve the event automatically utilizes the intelligence and the relationships to evaluate 
the validity of the solution. 

39. The computer readable medium of claim 38, wherein the validity of the 
solution is based upon previous success in resolving the event and descriptions of the 
related root cause. 

40. The computer readable medium of claim 38, wherein the validity of the 
solution is based upon previous success in resolving the event and descriptions of the 
related root cause. 

41 . The computer readable mediimi of claim 34, wherein the logic for 
determining whether the solution can resolve the event automatically includes 
determining whether a root cause has a statistically significant correlation with a defined 
set of tasks leading to a resolution of the event. 

42. The computer readable medium of claim 34, wherein the logic for 
determining whether the solution can resolve the event automatically includes using 
object-oriented constructs. 
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43. The computer readable medium of claim 34, wherein the logic for 

determining whether the solution can resolve the event automatically includes allowing a 
user to prevent automated resolution. 

44. The computer readable medium of claim 34, wherein the logic for 
automatically resolving the event includes providing information to a user by updating a 
trouble ticket. 

45. The computer readable medium of claim 34, wherein the logic for 
providing information for resolving the event to a user includes presenting the user with 
suggested corrective actions. 

46. The computer readable medium of claim 34, wherein the logic for 
providing information for resolving the event to a user includes evaluating the strength of 
relationships between a root cause constructs and a resolution construct. 

47. The computer readable medium of claim 34, wherein the logic for 
providing information for resolving the event to a user includes utilizing an object 
oriented model to define object constructs, wherein the constructs are then presented to 
the user. 

48. The computer readable medium of claim 34, wherein the logic for 
providing information for resolving the event to a user includes a visualization of the 
information for resolving the event. 

49. The computer readable medium of claim 34, wherein the logic for 
providing information for resolving the event to a user includes a visualization of the 
information for resolving the event, wherein the visualization includes providing an 
overlay, wherein the overlay offers information about the event. 
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50. The computer readable medium of claim 34, wherein the logic for 

providing information for resolving the event to a user includes providing a searchable 
knowledge base. 

5 1 . The computer readable medium of claim 34, wherein the logic for 
providing information for resolving the event to a user includes presenting a probability, 
wherein the probability is indicative of the success of the solution. 

52. The computer readable medium of claim 34, wherein the computer 
readable medium resides in a network, further including logic for revising the network 
based on data generated while resolving the event. 

53. The computer readable medium of claim 52, wherein the logic for revising 
the network includes revising a datastore within the network based on the event 
resolution. 

54. The computer readable medium of claim 34, wherein the computer 
readable medium resides in a network, further including logic for distributing solutions in 
the network. 

55. The computer readable medium of claim 34, wherein the computer 
readable medium resides in a network, further including logic for creating heuristics 
related to the solution, wherein the heuristics are configured to be available within the 
network to evaluate proposed solutions. 

56. The computer readable medium of claim 34, wherein the event is 
associated with a security fault. 

57. The computer readable medium of claim 34, wherein the event is 
associated with a network operational fault. 
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58. A system for decision analysis and resolution, wherein an event is 

associated with a root cause, the system comprising: 

means for relating a solution to the event based on the root cause; 

means for determining whether the solution can resolve the event automatically; 

means for automatically resolving the event when the event can be resolved 

automatically; and 

means for providing information for resolving the event to a user when the event 
cannot be resolved automatically. 

59. The system of claim 58, wherein the means for relating a solution to a root 
cause includes utilizing a solutions catalog. 

60. The system of claim 58, wherein the means for relating a solution to a root 
cause includes chaining a series of solution objects to the root cause. 

61 . The system of claim 58, wherein the means for relating a solution to a root 
cause includes interoperating with a trouble ticket system. 

62. The system of claim 58, wherein the events are related to object oriented 
constructs, wherein the object oriented constructs include underlying intelligence, 
wherein the intelligence includes relationships between the underlying object oriented 
constructs, wherein the means for determining whether the solution can resolve the event 
automatically utilizes the intelligence and the relationships to evaluate the validity of the 
solution. 

63. The system of claim 62, wherein the validity of the solution is based upon 
previous success in resolving the event and descriptions of the related root cause. 

64. The system of claim 62, wherein the validity of the solution is based upon 
previous success in resolving the event and descriptions of the related root cause. 
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65. The system of claim 58, wherein the means for determining whether the 

solution can resolve the event automatically includes determining whether a root cause 
has a statistically significant correlation with a defined set of tasks leading to a resolution 
of the event. 

66. The system of claim 58, wherein the means for determining whether the 
solution can resolve the event automatically includes using object-oriented constructs. 

67. The system of claim 58, wherein the means for determining whether the 
solution can resolve the event automatically includes allowing a user to prevent 
automated resolution. 

68. The system of claim 58, wherein the means for automatically resolving the 
event includes providing information to a user by updating a trouble ticket. 

69. The system of claim 58, wherein the means for providing information for 
resolving the event to a user includes presenting the user with suggested corrective 
actions. 

70. The system of claim 58, wherein the means for providing information for 
resolving the event to a user includes evaluating the strength of relationships between a 
root cause constructs and a resolution construct. 

71 . The system of claim 58, wherein the means for providing information for 
resolving the event to a user includes utilizing an object oriented model to define object 
constructs, wherein the constructs are then presented to the user. 

72. The system of claim 58, wherein the means for providing information for 
resolving the event to a user includes a visualization of the information for resolving the 
event. 
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73. The system of claim 58, wherein the means for providing information for 

resolving the event to a user includes a visualization of the information for resolving the 
event, wherein the visualization includes providing an overlay, wherein the overlay offers 
information about the event. 

74. The system of claim 58, wherein the means for providing information for 
resolving the event to a user includes providing a searchable knowledge base. 

75. The system of claim 58, wherein the means for providing information for 
resolving the event to a user includes presenting a probability, wherein the probability is 
indicative of the success of the solution. 

76. The system of claim 58, wherein the computer readable medium resides in 
a network, further including means for revising the network based on data generated 
while resolving the event. 

77. The system of claim 52, wherein the means for revising the network 
includes revising a datastore within the network based on the event resolution. 

78. The system of claim 58, wherein the computer readable medium resides in 
a network, further including means for distributing solutions in the network. 

79. The system of claim 58, wherein the computer readable medium resides in 
a network, further including means for creating heuristics related to the solution, wherein 
the heuristics are configured to be available within the network to evaluate proposed 
solutions. 

80. The system of claim 58, wherein the event is associated with a security 

fauh. 

8 1 . The system of claim 58, wherein the event is associated with a network 
operational fault. 
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